Score security awareness program maturity from phishing rates, training completion, MFA adoption, and reporting.